North Carolina’s Medicaid Control Environment, Risk Management Practices, and Governing Processes Were Assessed as Moderate Risk

Governance and Culture: The state agency established oversight bodies and committees, but several governance and structure controls were not fully defined; two sub-risk areas (Defines Desired Culture and Demonstrates Commitment to Core Values) were low risk, while Exercises Board Risk Oversight and Establishes Operating Structures were moderate risk, and Attracts, Develops, and Retains Capable Individuals was high risk due to lack of formal succession, contingency plans, staffing pressures, and inconsistent recruitment, training, mentoring, and retention plans.

Strategy and Objective-Setting: The sub-risk areas Analyzes Business Context and Defines Risk Appetite were moderate; Evaluates Alternative Strategies and Formulates Business Objectives were high risk due to lack of formal external environment assessments, no defined risk appetite, no documented objectives, and absence of formal performance measures.

Performance: The organization identified risk and had formal risk management processes but did not fully implement OCPI’s Compliance Monitoring Program, and did not consistently assess inherent vs residual risk or prioritize risks; lack of formal portfolio view and prioritization hinder risk responses.

Review and Revision: With the transition to managed care, there was no formal ERM strategy or policies governing its ERM; Reviews Risk and Performance and Pursues Improvement in ERM were rated high due to missing formal policies for performance assessment and lack of documented ERM strategy.

Information, Communication, and Reporting: Data reliability testing documentation was missing; formal policies governing communication with stakeholders and reporting requirements were incomplete; risks of regulatory reporting not being fully defined or met.

Federal Internal Control Requirements: The Federal internal control area was rated high risk; insufficient adoption of an internal control framework, and incomplete controls over compliance; policy gaps for managing findings of noncompliance and safeguarding sensitive information; incomplete documentation of internal controls for monitoring compliance.

Controls Over Compliance and Monitoring: There were weaknesses in addressing findings of noncompliance and safeguardingPII; the state did not fully document entity-level policies or formal policies governing monitoring of compliance.

Document reliability testing of data used for decision-making and improve data quality controls.

Strengthen governance with formal succession planning, contingency planning, and staff wellbeing initiatives; address staffing pressures and retention.

Clarify and document board oversight requirements, roles, authorities, and independence; improve operating structure oversight.

Develop procedures to assess external factors and substantial changes; implement formal ERM strategy and governance policies.

Develop mitigating controls and strategies to lower risk within the identified high- and moderate-risk areas.

Adopt a formal enterprise risk management program and invest in staff, policy development, and technology solutions for tracking and reporting.

Adopt an internal control framework (GAO Green Book or COSO) and implement standardized controls over compliance.

Develop formal policies for managing the resolution of noncompliance and for safeguarding sensitive information; implement procedures for monitoring compliance.

Formalize strategic planning policies, define objectives, and establish performance measures; include formal evaluation of external environment and development of risk appetite.

Enhance risk management practices by improving severity assessment, risk prioritization, and portfolio risk analysis; implement formal risk responses.

Establish formal policies for communicating risk with internal and external stakeholders; ensure reporting requirements are identified and met.